Criminal Management System
Monthly
SQL injection in vraj404 Criminal-Management-System, through commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4, lets remote attackers submit crafted values in the Officer Registration Form at Officers/addOfficer.php to alter backend MySQL queries. Publicly available exploit code exists, and the vendor's CVSS 4.0 vector rates the issue PR:N, while the independent assessment notes that a valid session may be required if the endpoint is not reachable without authentication. The project has not responded to the issue report, and no patched release is identified.
Unauthenticated SQL injection in the Search Page of vraj404 Criminal-Management-System (`Officers/searchOff.php`) allows remote attackers to manipulate the `Search` parameter passed to `mysqli_query`, exposing sensitive records and permitting limited data modification. The application is a niche open-source PHP project on a rolling release with no published affected or fixed version, and the vendor has not responded to the issue report; publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. With a CVSS 4.0 score of 6.9 and exposure-dependent preconditions, the practical risk is moderate and concentrated on Internet-reachable deployments.
SQL injection in vraj404 Criminal-Management-System's search.php lets unauthenticated remote attackers manipulate the Search parameter to access or alter limited data and affect availability, with low impact assessed across confidentiality, integrity, and availability. The project uses a rolling release, so all deployed snapshots up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 should be treated as potentially affected, and publicly available exploit code exists via the project's GitHub issue tracker. No CISA KEV listing or confirmed active exploitation is available, and real-world priority is low-to-moderate because exposure depends on an organization self-hosting and network-exposing this niche PHP application.
Unrestricted file upload in vraj404's Criminal-Management-System lets a remote attacker push an arbitrary file through the 'my_img' parameter handled by move_uploaded_file in home.php, which can result in attacker-controlled content being written into a web-reachable location and potentially executed. All deployments built from the repository up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected, and because the project follows a rolling release model with no tagged versions, there is no defined fixed release to upgrade to. Publicly available exploit code exists and the maintainer has not responded to the issue report, though real-world exposure is limited by the project's niche, single-developer nature and near-absent production footprint; no public exploit identified at time of analysis beyond the published proof-of-concept, and no CISA KEV listing applies.
SQL injection in vraj404 Criminal-Management-System, through commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4, lets remote attackers submit crafted values in the Officer Registration Form at Officers/addOfficer.php to alter backend MySQL queries. Publicly available exploit code exists, and the vendor's CVSS 4.0 vector rates the issue PR:N, while the independent assessment notes that a valid session may be required if the endpoint is not reachable without authentication. The project has not responded to the issue report, and no patched release is identified.
Unauthenticated SQL injection in the Search Page of vraj404 Criminal-Management-System (`Officers/searchOff.php`) allows remote attackers to manipulate the `Search` parameter passed to `mysqli_query`, exposing sensitive records and permitting limited data modification. The application is a niche open-source PHP project on a rolling release with no published affected or fixed version, and the vendor has not responded to the issue report; publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation. With a CVSS 4.0 score of 6.9 and exposure-dependent preconditions, the practical risk is moderate and concentrated on Internet-reachable deployments.
SQL injection in vraj404 Criminal-Management-System's search.php lets unauthenticated remote attackers manipulate the Search parameter to access or alter limited data and affect availability, with low impact assessed across confidentiality, integrity, and availability. The project uses a rolling release, so all deployed snapshots up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 should be treated as potentially affected, and publicly available exploit code exists via the project's GitHub issue tracker. No CISA KEV listing or confirmed active exploitation is available, and real-world priority is low-to-moderate because exposure depends on an organization self-hosting and network-exposing this niche PHP application.
Unrestricted file upload in vraj404's Criminal-Management-System lets a remote attacker push an arbitrary file through the 'my_img' parameter handled by move_uploaded_file in home.php, which can result in attacker-controlled content being written into a web-reachable location and potentially executed. All deployments built from the repository up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected, and because the project follows a rolling release model with no tagged versions, there is no defined fixed release to upgrade to. Publicly available exploit code exists and the maintainer has not responded to the issue report, though real-world exposure is limited by the project's niche, single-developer nature and near-absent production footprint; no public exploit identified at time of analysis beyond the published proof-of-concept, and no CISA KEV listing applies.